The penalty for screwing it up is 20m euros or 4% turnover - why is it not surprising that devs play it safe? This is entirely the laws fault for driving this behaviour.
That is not correct. This is the penalty for wilfully screwing it up, and refusing to engage with the regulator when challenged. The most likely outcome of being reported is some advice from the regulator about how to comply.
It isn't incidental that the penalty for being accused of willfully screwing it up is quite high: having to defend oneself against a 20 million dollar judgement.
